File Transfer Protocol (FTP)

Computer Networks and Internet Basics (9hrs) · Computer Fundamentals & Emerging Technologies

1. Definition

FTP (File Transfer Protocol) is the standard application-layer protocol for transferring files between a client and a server over a TCP/IP network (RFC 959). A user logs in to a remote server and then uploads, downloads, renames, deletes and lists files. Its distinguishing architectural feature is that it uses two separate TCP connections:

a control connection on port 21, kept open for the whole session, carrying commands and replies;
a data connection opened for each transfer (port 20 in active mode, or a negotiated high port in passive mode), carrying the file bytes.

This split makes FTP efficient (commands never wait behind bulk data) but awkward with firewalls and NAT.

2. How a Session Works

   CLIENT                                            SERVER (port 21 control)
     │  connect to port 21                                 │
     │  ─────────────────────────────────────────────────► │  220 FTP server ready
     │  USER raiyan ──────────────────────────────────────► │  331 Password required
     │  PASS ****** ──────────────────────────────────────► │  230 Logged in
     │  PASV ─────────────────────────────────────────────► │  227 Entering Passive
     │        (server opens a random data port)             │      Mode (192,168,1,5,195,80)
     │  ══════ data connection to that port ═══════════════ │
     │  RETR notes.pdf ───────────────────────────────────► │  150 Opening data connection
     │  ◄══════════════ file bytes ═══════════════════════  │
     │                                                      │  226 Transfer complete
     │  QUIT ─────────────────────────────────────────────► │  221 Goodbye

Active vs passive mode

Active mode — the server initiates the data connection back to the client (client sends PORT). Blocked by most client-side firewalls and NAT.
Passive mode — the client initiates the data connection to a server-chosen port (client sends PASV). Firewall-friendly, so it is the default in browsers and modern clients.

Transfer modes: ASCII (text, with line-ending conversion) and binary/image (exact bytes — must be used for images, archives, executables); also a rarely used EBCDIC mode.

3. Common Commands and Reply Codes

Command	Meaning	Reply examples
`USER` / `PASS`	Login credentials	230 logged in, 530 not logged in
`LIST` / `NLST`	List files in the current directory	150 → 226
`CWD` / `PWD`	Change / show directory	250, 257
`RETR`	Download a file	150, 226
`STOR`	Upload a file	150, 226
`DELE`, `RNFR`/`RNTO`, `MKD`	Delete, rename, make directory	250
`TYPE`	Set ASCII or binary mode	200
`QUIT`	End the session	221
—	Reply families: 1xx preliminary, 2xx success, 3xx need more info, 4xx temporary error, 5xx permanent error

4. FTP and Its Secure Relatives

Protocol	Port(s)	Transport	Encryption	Notes
FTP	21 + 20/random	TCP	None — plain text	Credentials and data can be sniffed
FTPS (FTP over TLS)	21 / 990	TCP	TLS (explicit or implicit)	FTP with SSL/TLS layered on
SFTP (SSH File Transfer Protocol)	22	TCP over SSH	Full SSH encryption	Not FTP at all — a subsystem of SSH; the modern default
SCP	22	TCP over SSH	SSH encryption	Simple secure copy, no interactive browsing
TFTP (Trivial FTP)	69	UDP	None	Tiny, no authentication; used for firmware/network device booting and PXE
HTTP/HTTPS	80/443	TCP	Optional (HTTPS)	Browser download/upload; simpler but no directory management

5. Advantages and Limitations

Advantages	Limitations
Simple, universal and supported everywhere	No encryption — username, password and file contents travel in clear text
Two connections keep control responsive; supports resuming partial transfers	Two connections and dynamic data ports complicate firewalls/NAT
Directory browsing, renaming, deleting — full remote file management	Typically one file at a time, no delta/parallel transfer
Supports batch scripts and anonymous access for public archives	Vulnerable to brute-force, bounce attacks, spoofing; needs SFTP/FTPS instead
Fine control over ASCII vs binary mode and transfer options	No built-in integrity verification beyond TCP's checksum

6. Applications

Publishing a website to a hosting server (uploading HTML/PHP/images) · uploading firmware or configuration to network devices and set-top boxes (often TFTP) · bulk transfer of large datasets between organisations · anonymous public file archives (software mirrors, Linux ISO servers) · automated nightly data exchanges in legacy business systems · and, in modern practice, the same tasks done securely over SFTP (used by tools such as WinSCP, FileZilla, Cyberduck, and scp/rsync on the command line).

7. Exam Points

Define FTP; explain the control and data connections with port numbers — 5 marks, most frequent question on this topic.
Differentiate active and passive FTP — 3-5 marks; why is passive preferred behind a firewall?
Explain any five FTP commands and their purpose — 5 marks.
Compare FTP with TFTP and SFTP/FTPS — 5 marks, frequent.
Why is plain FTP considered insecure, and what replaces it? — 3 marks.
What are the ASCII and binary transfer modes and when is each used? — 3 marks.

File Transfer Protocol (FTP)